PT-2005-3380 · Info Zip+1 · Unzip+1

Imran Ghory · Publicado 2005-08-05 · Atualizado 2024-06-15 · CVE-2005-2475

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Unzip version 5.52

Description A race condition exists in Unzip, allowing local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed. This occurs because Unzip changes the permissions of the file after decompression is complete, which can be exploited by creating a hard link to the file being decompressed.

Recommendations For Unzip version 5.52, consider updating to a newer version that addresses this issue, as using a hard link attack on a file being decompressed can lead to unauthorized permission changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-2475

DSA-903-1

OPENSUSE-SU-2024:11485-1

RHSA-2007:0203

RHSA-2007_0203

Produtos afetados

Red Hat

Unzip

Referências · 34

• http://securityfocus.com/bid/14450 · Nota
• https://access.redhat.com/errata/RHSA-2007:0203 · Nota
• http://ubuntu.com/usn/usn-191-1 · Aviso do Fabricante
• http://debian.org/security/2005/dsa-903 · Aviso do Fabricante
• http://secunia.com/advisories/17653 · Nota
• https://suse.com/security/cve/CVE-2018-1000035 · Nota
• http://osvdb.org/18530 · Nota
• http://marc.info/?l=bugtraq&m=112300046224117&w=2 · Nota
• https://suse.com/security/cve/CVE-2018-18384 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:11485-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2005-2475 · Nota
• https://access.redhat.com/security/cve/CVE-2005-2475 · Nota
• http://securityfocus.com/bid/15968 · Nota
• https://osv.dev/vulnerability/CVE-2005-2475 · Aviso do Fabricante
• http://info-zip.org/FAQ.html · Nota